Adversary Intelligence — 2026-06-09

Russia Expands SORM Surveillance Beyond Telecoms Requiring Major Companies to Install FSB Access Systems

BLUFMoscow's parallel expansion of SORM technical mandates and blanket FSB database-copy authority creates redundant coercive access paths that eliminate procedural shelter for non-telecom organizations holding autonomous system numbers.

Russia's Digital Development Ministry issued an order in late May providing FSB-compatible server specifications for SORM implementation by any organization holding an autonomous system number, a category extending beyond telecoms to major IT platforms, hosting providers, banks, universities, and large corporations 12. Meduza's review of ministry documents found the underlying data requirements, which cover passport data, tax IDs, bank account details, IP addresses, geolocations, and full records of user interactions, were set by a 2023 government decree and are unchanged; the new order supplies the technical transmission procedures that had been missing 1. Risky Business reported the pre-update minimum deployment cost around 5 million rubles (~$70,000), with costs expected to rise sharply under the new rules; separately, the government last week fined 85 telecoms for SORM non-compliance and enacted legislation authorizing license revocation for up to ten years 2.

Analysis
The ministerial order closes the compliance gap that let non-telecom ASN holders treat SORM as a telecom-sector obligation. Banks, major IT platforms, and universities now hold formal transmission specifications with no procedural basis to defer enrollment. The April 2026 FSB law granting blanket database-copy authority from any organization runs in parallel as a second coercive access vector, indicating the Kremlin is building redundant surveillance reach rather than relying on a single mechanism. Corroborated across Risky Business, Meduza, and The Record, the 85-telco fine campaign and license-revocation statute create an enforcement template structurally available against non-telecom violators. Whether FSB regional offices apply it on a comparable timeline cannot be assessed with confidence absent observable coordination indicators. The framework may instead function primarily as selective leverage against political targets, consistent with the Kremlin's history of tolerating informal non-compliance among smaller operators.

3 sources

Russia surveillance expansion builds parallel SORM inside every major company - Meduza
Risky Bulletin: Russia greatly expands SORM surveillance requirements - Risky Business Media
Russia upgrades rules for its digital spy system to better track citizens online - The Record